Is CVE-2026-112400 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112400 being exploited in the wild.

How severe is CVE-2026-112400?

High severity, with a CVSS score of 4, published 19 October 2026.

Which products and versions are affected?

Pillow 9.2.0 to 12.x; pillow (PyPI) >= 9.2.0, < 13.0.0, ECOSYSTEM:introduced=9.2.0,fixed=13.0.0.

Is there a fix for CVE-2026-112400?

Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112400 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112400?

Check whether you run Pillow or pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112400: Pillow GIF decompression bomb denial of service

Q: Is there a fix for CVE-2026-112400?

Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-112400 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-112400?

Check whether you run Pillow or pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112400 · Severity: high · CVSS 4 · Published 2026-10-19

Pillow is a Python library used to process images, including GIF files. A malicious GIF file can trigger an exception that leaves incorrect dimensions stored in memory; if an application catches the exception and continues processing the image, subsequent operations can consume all available memory and crash the program, causing a denial of service.

Technologies: Pillow, pillow (PyPI). Vendors: Pillow, PyPI.

Quick answers

Is CVE-2026-112400 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112400 being exploited in the wild.
How severe is CVE-2026-112400?: High severity, with a CVSS score of 4, published 19 October 2026.
Which products and versions are affected?: Pillow 9.2.0 to 12.x; pillow (PyPI) >= 9.2.0, < 13.0.0, ECOSYSTEM:introduced=9.2.0,fixed=13.0.0.
Is there a fix for CVE-2026-112400?: Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112400 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112400?: Check whether you run Pillow or pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pillow (PyPI): upgrade to 13.0.0 or later
```
pip install "pillow>=13.0.0"
```

Technical details

The vulnerability exists in Pillow's GifImageFile._seek function where a decompression-bomb check can reject a frame size due to excessive dimensions, but the rejected size is retained in the image object's state. If an application catches the Image.DecompressionBombError exception and continues using the same image object, subsequent seek or load operations allocate memory based on those rejected (oversized) dimensions, exhausting available memory. The issue affects versions 9.2.0 through 12.x and is fixed in 13.0.0.

Affected products

Pillow Pillow 9.2.0 to 12.x

Identifiers

CVE-2026-112400
GHSA-65qm-jvmh-6pqg

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.